{"id":"CVE-2026-13007","state":"PUBLISHED","title":"Insecure Public Caching on REST API Endpoints in Tenable Identity Exposure","description":"Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user accounts, and directory settings to unauthenticated remote attackers. Affected responses are served with Cache-Control: public headers and without Vary: Cookie, allowing reverse proxies and CDNs to cache and serve sensitive data to unauthenticated users even after authentication is applied.","publishedAt":"2026-06-23T15:59:50.522Z","updatedAt":"2026-06-23T17:48:03.138Z","severity":{"score":8.5,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N","source":"tenable"},"assigner":"tenable","products":["tenable Tenable Identity Exposure"],"affected":[{"vendor":"tenable","product":"Tenable Identity Exposure","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.93.5","versionType":"semver"}]}],"references":["https://www.tenable.com/security/research/tns-2026-16"],"weaknesses":["CWE-306","CWE-524"],"ingestedAt":"2026-10-29T20:11:00.674Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/13xxx/CVE-2026-13007.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-13007","state":"PUBLISHED","datePublished":"2026-06-23T15:59:50.522Z","dateUpdated":"2026-06-23T17:48:03.138Z","assignerShortName":"tenable","assignerOrgId":"5ac1ecc2-367a-4d16-a0b2-35d495ddd0be","dateReserved":"2026-06-23T14:57:21.550Z"},"containers":{"cna":{"title":"Insecure Public Caching on REST API Endpoints in Tenable Identity Exposure","descriptions":[{"lang":"en","value":"Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/* that expose sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user accounts, and directory settings to unauthenticated remote attackers. Affected responses are served with Cache-Control: public headers and without Vary: Cookie, allowing reverse proxies and CDNs to cache and serve sensitive data to unauthenticated users even after authentication is applied."}],"affected":[{"vendor":"tenable","product":"Tenable Identity Exposure","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"3.93.5","versionType":"semver"}]}],"references":[{"url":"https://www.tenable.com/security/research/tns-2026-16","name":"TNS-2026-16","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH"}},{"cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N","baseScore":8.5,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","type":"CWE","lang":"en","description":"Missing Authentication for Critical Function"}]},{"descriptions":[{"cweId":"CWE-524","type":"CWE","lang":"en","description":"Use of Cache Containing Sensitive Information"}]}],"providerMetadata":{"shortName":"tenable","orgId":"5ac1ecc2-367a-4d16-a0b2-35d495ddd0be","dateUpdated":"2026-06-23T15:59:50.522Z"},"credits":[{"lang":"en","value":"Cobalt (Tenable-commissioned penetration test)","type":"finder"}],"datePublic":"2026-06-23T00:00:00.000Z","x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-23T17:47:42.661656Z","id":"CVE-2026-13007","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-23T17:48:03.138Z"}}]}}}